Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-15 | 1 | Patch1 |
| 2026-09-16 | 2 | Disclosure1Patch1 |
| 2026-09-23 | 1 | Patch1 |
| 2026-09-25 | 1 | Patch1 |
nginx 1.31.6 released - Security: a heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439). https://nginx.org/en/CHANGES
Post summary
nginx version 1.31.6 has been released to patch a heap buffer overflow vulnerability (CVE-2026-90439) affecting HTTP/3 configurations with OpenSSL 3.5.0 and earlier.
EasyApache 4 v25.83 is now available. Updates include: • ea-nginx v1.31.6 with a security fix (CVE-2026-90439); cPanel builds are not affected • ea-php84 v8.4.25 • ea-php85 v8.5.10 • Updates to NGINX modules and ea-podman See the full changelog 👉 https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/#2583 https://t.co/qLpIzmjR0r
Post summary
Vendor changelog post announcing EasyApache 4 v25.83 includes a security fix for CVE-2026-90439 in ea-nginx v1.31.6, prioritizing the update.
『When using HTTP/3 with OpenSSL versions 3.5.0 and earlier under certain configurations, a limited heap buffer overflow could happen while processing a Transport Layer Security (TLS) handshake.』 NGINX ngx_http_v3_module vulnerability CVE-2026-90439 https://my.f5.com/manage/s/article/K000162604
Post summary
The text announces CVE-2026-90439, a vulnerability in the NGINX ngx_http_v3 module involving a limited heap buffer overflow during TLS handshakes when using HTTP/3 with older OpenSSL versions.
> nginx-1.30.5 stable version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439). > The ngx_http_v3_module module (1.25.0) provides experimental support for HTTP/3. https://github.com/nginx/nginx/releases/tag/release-1.30.5
Post summary
Nginx released stable version 1.30.5, which patches a buffer overflow vulnerability (CVE‑2026‑90439) in the ngx_http_v3_module.
nginxのHTTP/3モジュールにヒープバッファオーバーフローの脆弱性（CVE-2026-90439） — 修正版1.31.6と1.30.5が公開 https://cyber.nexsight.co/articles/2026/09/25/nginx-http3-ngx-http-v3-cve-2026-90439-2026-09-25/
Post summary
The text announces a heap buffer overflow vulnerability in the nginx HTTP/3 module (CVE-2026-90439) and highlights the availability of patched versions (1.31.6 and 1.30.5).